TranscendLinux.com

A couple of notes... using psa-spamassassin will result in all messages being scanned twice, which creates a lot of overhead.

Use the modified qmHandle's qmHandle -tt to see the top senders/recipients. Look at one of the spam messages and look at the Received line, which will either show you a UID or received from network.

If it shows you a UID, then the spam is coming from a compromised script.

Here's a typical log sequence for a message sent to a remote system from the local system:

1 @4000000038c3eeb027f41c7c new msg 93869
2 @4000000038c3eeb027f6b0a4 info msg 93869: bytes 2343 from dave@sill.org qp 18695 uid 49491
3 @4000000038c3eeb02877ee94 starting delivery 2392: msg 93869 to remote lwq@w3.to
4 @4000000038c3eeb0287b55ac status: local 0/10 remote 1/20
5 @4000000038c3eeb104a13804 delivery 2392: success: 209.85.127.177_accepted_message.

Here are the steps for integrating ClamAV with Plesk/Qmail:

* Stop all Plesk services and remove the drweb rpms

service psa stopall
rpm –e drweb drweb-qmail --nodeps --force

* Add the Atomic Rocket Turtle archive to the rhn sources